Password hashing uses non-blocking scrypt to avoid blocking event loop
Password hashing now uses non-blocking scrypt to avoid blocking the event loop during password hashing operations.
Better Auth · Authentication · all subjects
email & password passwords
8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
isPasswordCompromised API for Have I Been Pwned checking
Better Auth 1.7.3 adds isPasswordCompromised for checking passwords against Have I Been Pwned in custom server-side flows. It ignores padded response entries with zero occurrences.
checkPassword failure returns INVALID_PASSWORD error code
`INVALID_PASSWORD` error code is now used for all `checkPassword` failures.
Password storage location
A user's password is not stored in the user table. Instead, it is stored in the account table with `providerId` set to `credential`.
Password hashing algorithm
Better Auth uses `scrypt` to hash passwords. The `scrypt` algorithm is designed to be slow and memory-intensive to make it difficult for attackers to brute force passwords. OWASP recommends using `scrypt` if `argon2id` is not available. Better Auth uses `scrypt` because it is natively supported by Node.js.
Custom password hashing algorithm
Pass a custom password hashing algorithm by setting the `password` option in the `emailAndPassword` configuration. The option accepts an object with `hash` (custom password hashing function) and `verify` (custom password verification function) properties.
Custom password hashing with Argon2 example
Example using Argon2 with @node-rs/argon2: define hashPassword and verifyPassword functions with options (memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32, algorithm: 2 for Argon2id), then pass them to `emailAndPassword.password: { hash: hashPassword, verify: verifyPassword }`.
Minimum and maximum password length
By default, passwords must be at least 8 characters long and maximum 128 characters. These limits can be configured with `minPasswordLength` and `maxPasswordLength` options.